Modular redundant threshold circuit and method

ABSTRACT

Systems and methods for fault-tolerant threshold circuits used in converting an analog input to a single-bit digital output employ N-modular redundancy of either inverting or non-inverting threshold circuits whose inputs are connected to a single input, and apply majority voting of their outputs to provide correction of transient or permanent faults in up to floor[(N−1)/2] of the individual threshold circuits. Using summation to perform analog majority voting averages the N threshold circuit outputs and provides resilience to single-event transients, but may exhibit an output characteristic having intermediate voltage levels. A digital majority voter having N inputs connected to the outputs of N threshold circuits restores well-defined logic levels and clean hysteresis for Schmitt trigger threshold circuits. A single point of failure at the digital majority voter may be eliminated using an analog majority voter to sum the outputs of three or more redundant digital majority voters.

BACKGROUND OF THE INVENTION 1. Field of the Invention

The present invention relates generally to integrated circuits, and,more particularly, to fault-tolerant integrated circuits having highresilience to single-event effects.

2. Description of the Related Art

Circuits that provide a digital output level by comparing an analoginput to a reference threshold are used for a variety of functionsincluding analog-to-digital conversion, clock generation, and sensing. Athreshold circuit converts incoming data that may be an analog signal ora corrupted digital signal into a well-defined digital output level.Such threshold circuits can have a single threshold, as in a comparator,or separate low and high thresholds, in the cases of a comparator withhysteresis or a Schmitt trigger. Threshold circuits such as comparatorsmay operate continuously, or may be clocked in order to perform anevaluation of the input level at a specific time to provide a digitaloutput as part of a synchronized digital system. Schmitt triggers andcomparators with hysteresis are designed to output full-swing “clean”digital signals when presented with noisy input signals or slow inputtransitions, preventing intermediate voltages at the input fromaffecting the output, and without the output switching rapidly back andforth from noise around a single threshold.

Systems used in harsh environments or high-reliability criticalapplications may incorporate fault tolerance using methods such asvarious forms of redundancy. Fault tolerance using redundancy may beimplemented at various levels in such systems, from high-level system orsubsystem replication and sparing, and software error correctiontechniques, down to the gate or even device level in integrated circuitsused in the systems. Spacecraft and nuclear power exemplify applicationshaving strict requirements for both high reliability and operation inharsh environments; circuits used in such applications may encounterextreme temperatures and ionizing radiation.

Ionizing radiation can cause both permanent degradation of semiconductordevices due to dose effects, and also cause transient effects due todose-rate effects and single-event effects. In single-event effects(SEEs), impinging ionizing particles, such as cosmic rays, heavy ions,or protons, generate charge that causes temporary voltage glitches(known as single-event transients or SETs) leading to a transient changein an analog level or logic state. Single-event effects of several typesresulting from single-event transients may be analog or digital, andwhile they may be nondestructive, may result in errors or other variousforms of functional disruption of a system.

Integrated circuits for application in environments having high levelsof ionizing radiation may be fabricated using special processes, butthere is a current emphasis on using specialized IC design techniques(Radiation Hardening By Design or RHBD) instead of processes to improveradiation hardness. RHBD layout techniques, including redundancy, may beapplied to advanced commercial IC technologies that have higherperformance than dedicated rad-hard processes, at the expense of somecircuit area and some compromise in performance such as speed and powerconsumption. Specialized circuit designs and layout techniques exist forreducing susceptibility to radiation-induced errors. RHBD prevents theneed for development of new IC processes or for the fabrication ofentire IC wafers using a special rad-hard process, which can reduce theperformance of portions of ICs within the wafer that do not require thesame level of rad-hardness.

Threshold circuits are as susceptible to faults due to single-eventeffects as other analog and digital integrated circuit functions, andcan supply an erroneous output signal in response to single-eventtransients. There is thus a need for circuits and methods that providerobust resilience to transients and other types of failures and mitigatesingle-event effects, while providing a well-defined digital outputresponse to a given analog input level, in order to operate reliably andpredictably in a high-radiation environment.

SUMMARY OF THE INVENTION

The present invention addresses the need for radiation-hardenedfunctional circuits that incorporate various types of thresholdcircuits. Threshold circuits accept an analog or digital input signaland produce an output logic signal having well-defined digital levels,and include such circuits as Schmitt triggers, continuous and clockedcomparators, and comparators with hysteresis. The present inventionprovides circuits and methods to implement the functions of suchthreshold circuits while exhibiting improved resilience to transientsingle-event effects or other subcircuit failures. Embodiments ofcircuits and methods according to the present invention providewell-defined and error-free digital output signals with resilience tovarious failures by applying N-modular redundancy techniques that havebeen adapted for the specific characteristics of these types ofcircuits. Examples are given for implementation in CMOS integratedcircuit technology.

More specifically, the present invention provides a modular redundantcircuit for use in an integrated circuit, having a number N≥3 ofredundant threshold circuits, each having an input connected to a commoninput node, and each having an output connected to a majority votercircuit, with the output of the majority voter providing a valid outputlogic signal at an output node corresponding to a voltage at the inputnode that would be generated by a properly-operating threshold circuit,accommodating failures including transient or permanent errors in up tofloor[(N−1)/2] of the threshold circuits. In some embodiments, thenumber N of threshold circuits may be odd, in order to prevent ties fromoccurring at the majority voter. In some embodiments, the input node oroutput node or both may be connected to an external pad of theintegrated circuit. In some embodiments, the majority voter circuit maybe an analog majority voter, and in some embodiments, the majority votercircuit may be a digital majority voter. Embodiments employing an analogmajority voter provide resilience to single-event effects for any typeof threshold circuit, whereas embodiments using a digital majority voteradditionally provide well-defined logic levels for threshold circuitshaving hysteresis.

In some embodiments, the majority voter circuit may be implemented usinga number M≥3 of redundant digital majority voters, each having N voterinputs connected to the outputs of the N threshold circuits, and ananalog majority voter having M analog voter inputs connected to the Mdigital voter outputs, in order to eliminate a single point of failurethat could occur using a single digital majority voter. The number M ofdigital majority voters may be odd to prevent the possibility of a tieoccurring at the analog majority voter.

In some embodiments, an integrated circuit may include a semiconductorsubstrate having a functional circuit formed on the surface; at leastone modular redundant threshold circuit that may include an input node,a number N≥3 of threshold circuits each having an input connected to theinput node, and each having an output connected to an input of amajority voter circuit having a voter output connected to an output nodeand providing an output logic signal; and at least one pad usable forconnection to external circuitry. In some embodiments, the number N ofthreshold circuits may be odd in order to prevent ties from occurring.In some embodiments, either the input node or the output node or bothmay be connected to a pad of the integrated circuit. In someembodiments, the integrated circuit may include a fault detectioncircuit connected to the modular redundant threshold and configured toprovide a signal indicating that an error or failure is occurring, orhas occurred, in some portion or portions of the modular redundantthreshold circuit, and optionally report in which portion of the modularredundant threshold circuit an error or failure occurred.

In some embodiments, a method for generating an output logic signal mayinclude providing an input signal, applying the input signal to a numberN≥3 of threshold circuits, and performing a majority voting operation onthe individual output signals of the threshold circuits. In someembodiments, the number N of threshold circuits may be odd in order toprevent ties from occurring. In some embodiments, the majority votingoperation may be an analog majority voting operation, and in someembodiments, the majority voting operation may be a digital majorityvoting operation. In some embodiments, the step of performing a majorityvoting operation may comprise providing M≥3 digital majority voters,applying the output signals from the N threshold circuits to each of theM digital majority voters, and performing an analog majority votingoperation on the M digital majority outputs to generate the output logicsignal. The number M of digital majority voters may be odd to preventthe occurrence of ties.

Other features and advantages of the present invention will be apparentto those skilled in the art upon reference to the following detaileddescription taken in conjunction with the accompanying drawings, whichare to be understood to be exemplary and explanatory, and are intendedto provide further explanation of the invention as claimed.

BRIEF DESCRIPTION OF THE VIEWS OF THE DRAWINGS

FIG. 1 is schematic circuit diagram of a triple modular redundantthreshold circuit using inverting Schmitt triggers and analog majorityvoting.

FIGS. 2A-2D are plots of output vs. input voltage characteristics usedto describe the operation of the circuit shown in FIG. 1 .

FIG. 3A is a schematic circuit diagram of a triple modular redundantSchmitt threshold circuit using a digital majority voter.

FIG. 3B is a schematic circuit diagram of a triple modular redundantSchmitt threshold circuit showing one embodiment of a digital majorityvoter circuit.

FIGS. 4A-4D are plots of output vs. input voltage characteristics usedto describe the operation of a triple modular redundant Schmittthreshold circuit using a digital majority voter as shown in FIG. 3A or3B.

FIG. 5 shows a schematic circuit diagram of a CMOS digital majorityvoter with the Boolean equation that it implements and the correspondingtruth table.

FIG. 6 is a schematic circuit diagram of a 5-modular redundant Schmittthreshold circuit.

FIG. 7 is a schematic circuit diagram of a triple modular redundantSchmitt threshold circuit using redundant digital majority voters toeliminate single points of failure.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

The following Detailed Description is merely exemplary in nature and isnot intended to limit the various embodiments or the application anduses thereof. Furthermore, there is no intention to be bound by anytheory presented in the preceding background or the following detaileddescription. The techniques and structures described below may beapplied in fields and applications beyond those specified here asexamples, and the disclosed invention is therefore not to be consideredlimited to the applications and examples used here for the sake ofexplaining its principles of operation.

Each signal described herein may be designed using positive or negativelogic, where negative logic can be indicated by a bar over the signalname or “_BAR” following the name. In the case of a negative logicsignal, the signal is active low where the logically true statecorresponds to a logic level zero. In the case of a positive logicsignal, the signal is active high where the logically true statecorresponds to a logic level one. Note that any of the signals describedherein can be designed as either negative or positive logic signals, andtherefore in alternate embodiments, those signals described as positivelogic signals may be implemented as negative logic signals, and viceversa. As is known by those skilled in the art, combinational logicperformed on opposite-polarity logic signals may be implementedequivalently in alternate embodiments using De Morgan's theorem.

Threshold circuits are designed to accept an analog input voltage or acorrupted or weak digital input signal and to output a well-defined(valid) digital logic signal. Examples of types of threshold circuitsthat may be used in embodiments include Schmitt triggers, invertingSchmitt triggers (Schmitt inverters), and various types of comparatorsincluding continuous-time comparators without or with hysteresis, andclocked comparators, also called dynamic or latched comparators. Suchthreshold circuits essentially perform a single-bit quantization(analog-to-digital) function.

FIG. 1 shows a schematic circuit diagram of a first embodiment of amodular redundant threshold circuit 100 according to the presentinvention. In this triple modular redundant example, an input node 101is connected to the inputs of three redundant threshold circuits 110,120, and 130. In the present context, the term “redundant” will beunderstood to refer to substantially identical modules, in the sensethat they are expected to function the same in terms of providing thesame output signal in response to the same input signal. If circuit 100is fabricated in an integrated circuit technology, threshold circuits110, 120, and 130 may be implemented using identical devices and layoutsin nearby portions of an integrated circuit substrate, so that theirelectrical characteristics may be closely matched. Input node 101 mayoptionally supply an input signal from a source external to anintegrated circuit, as indicated schematically in FIG. 1 by input pad160; or an input signal may arise internal to an integrated circuitcontaining circuit 100, in which case input node 101 may be an internalnode in the integrated circuit. When presented by the same input signal,threshold circuits 110, 120, and 130, having matched electricalcharacteristics, will normally produce output signals at theirrespective outputs 112, 122, and 132 that are substantially equal. InCMOS, this means that the output voltages from threshold circuits 110,120, and 130 will be the same for a given input voltage at input node101. In the embodiment shown in FIG. 1 , threshold circuits 110, 120,and 130 are shown as Schmitt inverters, in which a high input voltageresults in a low output voltage, with hysteresis characteristics to bedescribed later, but it will be understood by those skilled in the artthat the principles of the present invention also apply to other typesof threshold circuits.

Single-event transients (SETs) or other failures may result in anerroneous output signal from an individual threshold circuit 110, 120,or 130. Using a majority voter 170 together with three or more redundantthreshold circuits permits a correct signal to be produced at outputnode 102 despite an error in one of threshold output signals 112, 122,or 132. The number N of threshold circuits must be at least three toenable a majority. A tie may be prevented by using any odd number Ngreater than or equal to three redundant threshold circuits. Majorityvoting is possible using N=4 or a greater even number, although ties arethen possible. If it is determined for a particular application that theprobability is acceptably low for an error or failure to simultaneouslyoccur in half of the threshold circuits, then an even number N greaterthan 3 of threshold circuits may be used.

Majority voter 170 in FIG. 1 represents a simple analog majority voterthat is implemented by simply connecting the outputs 112, 122, and 132of threshold circuits 110, 120, and 130 to a summing node 172 thatfunctions as the voter output and is connected directly to output node102. When threshold circuits 110, 120, and 130 are matched and havesubstantially equal output impedances, and summing node 172 is connectedto a relatively high-impedance node such as transistor gate in a CMOSinput, then a failure (such as a SET) in one of the threshold circuitswill create a voltage divider that pulls the voltage of summing node 172to an intermediate voltage at most approximately one-third of the wayfrom the full logic swing, but the two correct threshold circuits willdominate and can still hold the output node 102 at a logic level that isconsidered valid. In the common case of a very short-durationsingle-event transient, the capacitance at summing node 172 may preventthe voltage at output node 102 from reaching even this one-third point;and using a number N greater than three threshold circuits will resultin single errors causing an even smaller change in the output level, sothat there is a correspondingly lower probability of either an incorrector an invalid logic level at output node 102 than for N=3. Output node102 may be an internal node in an integrated circuit, which in CMOS maybe connected to high-impedance inputs such as the gates of MOStransistors, or it may be connected to an output pad (not shown) of theIC, if threshold circuits 110, 120, and 130 have sufficient output drivestrength (current drive capability). If additional current drive isrequired, individual buffers (not shown) may be connected betweenoutputs 112, 122, and 132 and summing node 172. Using individual buffersbefore summing at node 172 is preferable to using a single bufferbetween summing node 172 and output node 102, in order to prevent apossible single point of failure due to, e.g., a SET occurring in abuffer.

It can be seen from the foregoing discussion that analog majority votingis a simple method to implement redundancy and SET resilience in a CMOSor similar technology circuit having low to moderate output impedancesand high input impedances. But in some applications, the fact thatthreshold circuits 110, 120, and 130 are not identical—even if they arecarefully and identically designed, and positioned close to each otherwithin an IC—can result in nonideal behavior of a modular redundantthreshold circuit 100 using analog majority voting. As a specificexample, with (inverting) Schmitt trigger threshold circuits as in FIG.1 , the positive-going thresholds may not be identical between the Nthreshold circuits, nor may be the negative-going thresholds. Variationsin Schmitt threshold voltages may result from various unintendedimperfections in electronic devices; in modern silicon submicron CMOS ICprocesses, the main sources of variability may be statistical variationin doping concentrations in wells and polysilicon gates, followed bylithographic imperfections and gate oxide thickness variations. Theeffect of such gate-to-gate differences in Schmitt threshold voltageswill be described now in reference to FIGS. 2A-2D.

Referring now to FIG. 2A, a plot 212 illustrates the hysteretic voltageresponse of an isolated inverting voltage-mode Schmitt trigger 110. Plot212 shows output voltage V₁₁₂, the voltage at output 112 of Schmitttrigger threshold circuit 110, as a function of the voltage V₁₀₁ at itsinput (i.e., the terminal of threshold circuit 110 that is connected toinput node 101). Plot 212 assumes now for the sake of explanation thatthreshold circuit 110 is isolated, i.e., that node 112 is temporarilydisconnected from other loads including the outputs of the otherthreshold circuits 120 and 130, and thus illustrates the behavior ofthreshold circuit 110 operating independently. As input voltage V₁₀₁ isswept up from zero, Schmitt inverter output 112 stays at a logic HIGHvoltage level V_(OH) until input voltage V₁₀₁ reaches positive-goingthreshold V_(T+(110)), also indicated for further reference by verticaldashed line 210, at which input voltage the output voltage V₁₁₂ makes atransition from positive-going transition point 253 down to a logic LOWoutput voltage level V_(OL), where it stays for higher values of inputvoltage V₁₀₁. Positive-going thresholds for threshold circuits 120 and130 are also included for comparison and indicated by vertical dashedlines 220 and 230, respectively. For downward-going input voltages, theoutput voltage level remains at V_(OL) until negative-going thresholdV_(T−(110)) is reached at negative-going transition point 453, at whichpoint output voltage V₁₁₂ transitions to a logic HIGH output voltagelevel V_(OH) where it remains for lower values of input voltage Vim, oruntil the input voltage again exceeds positive-going thresholdV_(T+(110)). (For clarity, vertical dashed lines corresponding tonegative-going thresholds are omitted.) The function of a Schmitttrigger is to produce a valid unambiguous logic output signal whenpresented with noisy signals or slow input transitions at its input. Thehysteretic characteristic just described is standard for single Schmitttriggers (in this case inverting), and it would be preferable for aradiation-hardened Schmitt trigger to exhibit this same type of behaviorwith a simple hysteresis response, i.e., having single positive-goingand negative thresholds, and producing well-defined output logic levelswhen presented with intermediate input voltages that may have noise ofan amplitude smaller than the voltage difference between thenegative-going and positive-going threshold voltages. [Note that thevoltage plots 212, 222, 232, and 252 in FIGS. 2A-2D are schematic, andit will be understood that the input-output characteristics of realthreshold circuits will not display perfectly vertical nor horizontallines, nor perfectly sharp corners such as 253, 254, 255, 453, 454, and455 like those drawn herein for explanatory purposes.]

FIGS. 2B and 2C present similar plots 222 and 232 of the output voltagesV₁₂₂ and V₁₃₂ for Schmitt trigger threshold circuits 120 and 130,respectively. In FIG. 2B, it can be seen that transitions for anindependent and isolated threshold circuit 120 would occur atpositive-going threshold V_(T+(120)), additionally indicated by verticaldashed line 220 and transition point 254, and at negative-goingthreshold V_(T−(120)) with associated transition point 454. Similarly,in FIG. 2C, transitions for an isolated threshold circuit 130 wouldoccur at positive-going threshold V_(T+(130)), additionally indicated byvertical dashed line 230 and transition point 255, and at negative-goingthreshold V_(T−(130)) with its associated transition point 455. For thesake of this example, the magnitudes of the differences between thethreshold voltages for the three threshold circuits have been greatlyexaggerated relative to the difference between the input logic voltagelevels, and both negative-going and positive-going thresholds havearbitrarily been chosen to lie in increasing order for thresholdcircuits 110, 120, and 130. In real integrated circuits, the thresholdswould likely be more closely matched, and the negative-going thresholdsfor the associated threshold circuits might not increase in the sameorder as their positive-going thresholds.

FIG. 2D shows a plot 252 of an overall input characteristic forembodiment 100 of a modular redundant threshold circuit, plotting thevoltage V₁₀₂ at output node 102 for the case of analog majority votingusing summing node 172 with three Schmitt inverters as in FIG. 1 . Forclarity, only the positive-going portion of the hysteresis curve isshown. When Schmitt trigger threshold circuits 110, 120, and 130 arematched, to the extent that they have approximately equal outputimpedances, and their outputs are connected together at summing node172, the voltage at output node 102 exhibits a stepped response asshown, as input voltage V₁₀₁ is swept from low to high levels. Namely,voltage V₁₀₂ for the redundant Schmitt inverter with analog majorityvoting starts at the full HIGH logic level V₃=V_(OH), and makes a firsttransition at V_(T+(110)) (dashed line 210) and transition point 253down to a voltage level V₂ that is approximately one-third of the waydown to the LOW logic level V_(OL); at V_(T+(120))(dashed line 220), asecond transition occurs at 254 down to V₁, which is two-thirds of theway down to V_(OL); and finally, when input voltage V₁₀₁ crossesV_(T+(130))(dashed line 230), a final third transition occurs attransition point 255 down to a full LOW logic level V_(OL). Note thattransition points 253, 254, and 255 in the overall input-outputcharacteristic occur at the same three input threshold voltages as thosefor the independently-operating Schmitt triggers 110, 120, and 130,respectively, but at intermediate output voltage levels V₃, V₂, and V₁between V_(OH) and V_(OL) that are determined by the loading of theSchmitt trigger outputs by each other and any other loads associatedwith output node 102. A similar stepped response (not shown) would occurin the downward direction at negative-going thresholds V_(T−(130)),V_(T−(120)), and V_(T−(110)), in sequential order as V₁₀₁ is decreased,and transition points 455, 454, and 453 would apply in sequence.Although such a response is nominally hysteretic, it undesirablyincludes intermediate output voltage levels that are not well-definedlogic levels, although they might be interpreted by following circuitryas valid levels. Thus, although the analog majority voting by voter 170prevents errors in individual Schmitt triggers from producing anincorrect output logic level, a clean hysteretic response with singletransitions between full logic levels is not provided using the circuitof FIG. 1 .

For some types of threshold circuits such as Schmitt triggers,embodiments using digital majority voting, instead of analog majorityvoting, may result in a more well-defined input-output characteristicfor a modular redundant threshold circuit. The number N of redundantthreshold circuits may be three or greater, and may be chosen to be anodd number to avoid the possibility of a tie vote occurring. Referringnow to FIG. 3A, a schematic circuit diagram for a triple modularredundant Schmitt threshold circuit 300 using a three-input digitalmajority voter 370 is shown. Similar to modular redundant circuit 100 inFIG. 1 , an input node 101 is connected to redundant threshold circuits110, 120, and 130 and to an optional input pad 160. Respective outputs112, 122, and 132 of threshold circuits 110, 120, and 130 are eachconnected to a respective input of digital majority voter 370. Digitalmajority voter 370 produces an output signal at output node 102 that isa valid logic signal reflecting the majority of threshold circuitoutputs 112, 122, and 132; that is, for the case of triple redundancy,if at least two of signals 112, 122, and 132 are HIGH, then the outputof digital majority voter 370 will be HIGH, and if at least two ofsignals 112, 122, and 132 are LOW, then the output of digital majorityvoter 370 will be LOW. (It will be apparent to those skilled in the artthat embodiments using an inverting version of digital majority voter370, providing an opposite polarity output, are also possible and may beuseful.) Output node 102 may be connected to an internal node of anintegrated circuit, or optionally to an external output pad.

In FIG. 3B, a schematic circuit diagram or digital logic diagram showsone possible exemplary embodiment of a three-input digital majorityvoter 370 implemented using two-input NAND gates 371, 372, and 373, andthree-input NAND gate 374. This circuit performs the digital majorityfunction just described using all NAND gates. The two inputs of NAND 371are connected to outputs 112 and 122 of threshold circuits 110 and 120;the two inputs of NAND 372 are connected to outputs 112 and 132 ofthreshold circuits 110 and 130; and the two inputs of NAND 373 areconnected to outputs 122 and 132 of threshold circuits 120 and 130;while the outputs of NAND gates 371, 372, and 373 are connected to thethree inputs of NAND 374, and the output of NAND 374 serves as theoutput of digital majority voter 370, which is connected to output node102. It is known to those skilled in the art that alternativearrangements of logic gates, such as a combination of AND and OR gates,or all NOR gates, may also be used in alternative embodiments toimplement a digital majority voting function in voter 370.

An example of how using a digital majority voter 370 produceswell-defined logic levels with hysteretic behavior in circuit 300, inwhich the threshold circuits are Schmitt trigger inverters, isillustrated in FIGS. 4A-4D, which are plots analogous to those of FIGS.2A-2D, but now with additional vertical dashed lines 217, 227, and 237,associated respectively with the negative-going thresholds V_(T−(110))of Schmitt inverter 110, V_(T−(120)) of Schmitt inverter 120, andV_(T−(130)) of Schmitt inverter 130. In fact, except for theseadditional lines to direct attention to the negative-going thresholds,FIGS. 2A-2C are identical to FIGS. 4A-4C; that is, both FIG. 4A and FIG.2A plot the same response 212 of independent Schmitt inverter 110; bothFIG. 4B and FIG. 2B plot the same response 222 of independent Schmittinverter 120; and both FIG. 4A and FIG. 2A plot the same response 232 ofindependent Schmitt inverter 130. Vertical dashed lines 210, 220, and230 still mark the positive-going threshold voltages, and theirpositions are the same, as are the positions of the transition points:253 and 453 for Schmitt inverter 110; 254 and 454 for Schmitt inverter120; and 255 and 455 for Schmitt inverter 130. However, a plot 352 ofthe overall input-output characteristic of modular redundant thresholdcircuit 300 using digital majority voter 370 in FIG. 4D shows a cleanhysteresis curve having a single positive-going threshold and a singlenegative-going threshold. Digital majority voter 370 ensures that output102 changes state only at a point where the second of three Schmittinverters changes its output (i.e., as soon as a majority of the threethreshold circuits is reached). Since, in this example, bothpositive-going and negative-going thresholds of Schmitt inverter(threshold circuit) 120 are between the corresponding thresholds of theother threshold circuits 110 and 130, it happens that the hysteresiscurve 352 in FIG. 4D looks the same as curve 222 for threshold circuit120 in FIG. 4B (and FIG. 2B), having the same positive-going threshold220 (V_(T+(120))) and negative-going threshold 227 (V_(T−(120))), andthe same transition points 254 and 454, as the thresholds and transitionpoints for threshold circuit 120 were it connected only to ahigh-impedance input of digital majority voter 370 (effectively unloadedin circuit 300, in comparison to its application using analog majorityvoter 170 in circuit 100). A different order of threshold voltages forthe three threshold circuits would result in a different overallhysteresis curve having different values for the positive-going andnegative-going thresholds, but still desirably exhibiting singlethresholds and transition points in both directions. Similar cleanhysteresis curves are obtained for N>3, since an overall outputtransition only occurs when a majority of the threshold circuits reachesthe same state.

Referring now to FIG. 5 , a schematic circuit diagram is shown of anexemplary CMOS digital majority voter circuit 500 that implements amajority function for three logic inputs 501 (A), 502 (B), and 503 (C).Series pairs of PMOS transistors 521 (P1) and 522 (P2), 523 (P3) and 524(P4), 525 (P5) and 526 (P6), and NMOS transistor pairs 511 (N1) and 512(N2), 513 (N3) and 514 (N4), 515 (N5) and 516 (N6), are connected asshown, with input 501 (A) connected to the gates of 511 (N1), 521 (P1),516 (N6), and 526 (P6), input 502 (B) connected to the gates of 512(N2), 522 (P2), 513 (N3), and 523 (P3), and input 503 (C) connected tothe gates of 514 (N4), 524 (P4), 515 (N5), and 525 (P5). The sources ofPMOS transistors 521 (P1), 523 (P3), and 525 (P5) are connected topositive supply node 540 (V_(DD)), and the sources of NMOS transistors512 (N2), 514 (N4), and 516 (N6) are connected to negative supply node530 (V_(SS)). The drains of PMOS transistors 522 (P2), 524 (P4), and 526(P6), as well as the drains of NMOS transistors 511 (N1), 513 (N3), and515 (N5) are connected together and to a common intermediate output node504 that could serve as an inverted majority output Y_BAR. Each series“column” of transistors, for example leftmost column 511 (N1), 512 (N2),521 (P1), and 522 (P2) effectively functions as a two-input NAND gatefor a pair of inputs—e.g., in the leftmost column, for inputs 501 (A)and 502 (B); and the interconnection at intermediate output node 504operates as a three-input AND gate. Inverted majority output 504 can beinverted again by CMOS inverter 570 consisting of transistors 517 (N7)and 527 (P7) to provide a noninverted majority output 505 (Y). Thecircuit implements the logic represented by Boolean equation 551,specifically Y=(A AND B) OR (B AND C) OR (A AND C), and the truth table552 is also shown generating both noninverted output 505 (Y) andinverted output 504 (Y_BAR).

FIG. 6 is a schematic circuit diagram of a quintuple (5-modular)redundant Schmitt threshold circuit 600. In this embodiment, fiveredundant threshold circuits (Schmitt inverters) 110, 120, 130, 140, and150 are all driven by common input 101 (connected to optional input pad160), and their respective threshold circuit outputs 112, 122, 132, 142,and 152 are all connected to separate respective inputs of five-inputdigital majority voter 670, which supplies an output signal 102implementing the majority function either to an internal IC node or toan optional output pad for external connection (not shown). Forfive-input majority voter 670, the output will be HIGH if three or moreof its inputs are HIGH, that is, three or more of threshold circuits110, 120, 130, 140, and 150 have HIGH output signals 112, 122, 132, 142,and 152. In general, an N-modular redundant threshold circuit, i.e.,having N redundant threshold circuits and an N-input majority voter,will provide a correct output as long as floor[(N−1)/2] or fewer of theN threshold circuits are presenting erroneous inputs to majority votercircuit 670, and the majority voter 670 itself is operating properly.The complexity, i.e., the required number of transistors in the internalcircuitry of digital majority voters having higher numbers of inputsincreases more rapidly than linearly as the number of inputs increases.Thus, for some configurations, a digital majority voter circuit mayrequire more transistors to implement than N redundant thresholdcircuits, favoring modular redundant threshold circuits with smallervalues for N. Error and failure probabilities due to threshold circuitsand majority voter components can be used to calculate an optimumtradeoff between overall circuit complexity, its reliability, and itscapability to correct errors.

In some embodiments, an optional fault detection circuit may be includedwith a modular redundant threshold circuit according to the presentinvention. This fault detection circuit may, for example, be integratedwith embodiments incorporating digital majority voting such as modularredundant threshold circuits 300 and 600. Using circuit 600 of FIG. 6 asan example, an optional fault detection circuit (not shown) may beconnected to a subset of signals including input 101, threshold circuitoutputs 112, 122, 132, 142, and 152, and nodes within digital majorityvoter 670, may process these signals using combinational logic, and maypossibly latch a subset of the input and output signals, in order toprovide a diagnostic signal indicating that an error is occurring, orhas previously occurred. Such errors may arise in one or more of thethreshold circuits 110, 120, 130, 140, or 150, or within digitalmajority voter circuit 670, due to SETs or other failures. Thediagnostic signal may be configured to provide a simple binaryindication of the occurrence of an error (past or present); or multiplediagnostic signal output bits may be generated by the fault detectioncircuit, and used to signify not only the occurrence, but also tolocalize and indicate the origin of such an error.

Errors in redundant threshold circuits can be corrected by a majorityvoting operation, but digital majority voters in particular may besusceptible themselves to errors caused by single-event transients orother failure. Therefore, a further level of redundancy can be added toperform a majority voting operation on the outputs of redundant digitalmajority voters in order to eliminate a single point of failure in themajority voter. An example embodiment of a triple modular redundantthreshold circuit 700 having enhanced resilience by using redundantmajority voters is shown in the schematic circuit diagram of FIG. 7 . Inthis embodiment, three redundant digital majority voters 370, 380, and390 each vote on the output signals 112, 122, and 132 from thetriple-redundant threshold circuits (in this example, Schmitt inverters110, 120, and 130), and the three respective outputs 375, 385, and 395of digital majority voters 370, 380, and 390 are themselves voted uponby analog majority voter 770 comprising summing node 772 connected tooutput node 102. Optional buffers 710, 720, and 730 may be included toenhance the analog voting operation fidelity, by improving the outputdrive characteristics of digital majority voter outputs 375, 385, and395 in order to generate stronger output signals 712, 722, and 732,respectively. Analog majority voter 770 is relatively immune to SETs,for the reasons discussed with reference to FIG. 1 , while adding littlecomplexity to circuit 700. Output node 102 may be an interior node of anintegrated circuit, or optionally connected to an output pad (orinput/output I/O pad) 165 for use, e.g., in a standalone integratedcircuit. It is preferable to use separate (and thus effectivelyredundant) buffers 710, 720, and 730 to drive an output pad 165, ratherthan to insert a single buffer in between summing node 772 and outputnode 102, in order to avoid having such a single buffer be a singlepoint of failure susceptible, e.g., to SETs.

Although the number of digital majority voters M in circuit 700 is shownas three in this example, i.e., having the same number of digitalmajority voters as threshold circuits such that M=N=3, it is notnecessary for the number of digital majority voters M to equal thenumber of redundant threshold circuits N. The illustrated example inFIG. 7 shows a minimal configuration to accomplish redundancy ofthreshold circuits as well as redundancy of digital majority voterswithout the possibility of ties occurring. Analog majority voter 770 hasthe same number of inputs M as the number of digital majority voters,each of which has a single output. In general, either or both of alarger number N than three of threshold circuits (with a correspondinglarger number of inputs for each digital majority voter) or a largernumber M than three of digital majority voters may be used. Using alarger number N of threshold circuits rapidly increases the complexityof each digital majority voter, while reducing the probability ofsimultaneous errors arising in the threshold circuits. Increasing thenumber M of digital majority voters improves the resilience of theanalog majority operation to a single error in a digital majority voter,without significantly increasing the complexity of analog majority voter770 or its susceptibility to single-event effects.

Circuit realizations of embodiments of the present invention may beimplemented within an integrated circuit comprising a semiconductorsubstrate, a functional circuit comprising at least one modularredundant threshold circuit embodying the majority voting principles andcircuits described herein, and at least one pad usable for connection toexternal circuitry.

It will be appreciated that the various circuit embodiments describedherein are exemplary hardware realizations of a method for generating acorrect output logic signal that is resilient to errors such as SETs, inresponse to an input signal to be analyzed by a threshold circuit. Inthe method, an input signal is provided, that for example may be ananalog or corrupted digital signal. A number N equal to three or moreredundant threshold circuits, each having an input and producing anindividual output signal in response to a signal at its input, areprovided, and the input signal is applied simultaneously (i.e., inparallel) to the inputs of each of the N threshold circuits. A majorityvoting operation is performed on the individual output signals of thethreshold circuits to generate the output logic signal. Embodiments inwhich the majority voting operation is an analog majority votingoperation, a digital majority voting operation, or a combination ofdigital and analog majority voting operations are comprehended withinthe scope of the invention.

Circuits and methods provided by the present invention may beimplemented by applying these designs and methods in high-performancecommercial IC processes and can provide increased radiation tolerancewithout requiring the use of specialized rad-hard fabrication processes.While the present invention has been particularly shown and described indetail in the foregoing specification with reference to specificexemplary embodiments thereof, it will be evident that variousmodifications and changes may be made thereto without departing from thebroader spirit and scope of the invention as set forth in the appendedclaims. For example, it will be apparent to those skilled in the artthat while the present invention has been illustrated using examplesfrom CMOS integrated circuit technology, other IC technologies usingdifferent materials and device configurations, or discrete devicetechnologies may be used to implement the inventive principles that aredescribed. Additional components and conventional connections notexplicitly drawn or described, such as power supply and bypassconnections, any required pull-up resistors or loads or alternativeinput or output configurations constituting standard practice may beused in implementing embodiments without departing from the scope of theinvention. Likewise, integrated circuits according to the presentinvention may include electrostatic discharge, overvoltage, and/orovercurrent protection circuits among other ancillary circuits in someembodiments.

Furthermore, alternative equivalent embodiments may be implemented usingvarious logic implementations of digital circuits and a variety ofanalog circuit designs. In addition, combinations of the exemplaryembodiments may be made in multiple alternate ways to form more complexdevices than illustrated in the figures herein. The specification anddrawings are, accordingly, to be regarded in an illustrative rather thana restrictive sense.

We claim:
 1. A modular redundant threshold circuit for use in anintegrated circuit, comprising: an input node; a number N of redundantthreshold circuits, each having an input and an output, an input of eachthreshold circuit connected to the input node, wherein the number N isequal to or greater than three; a majority voter circuit having voterinputs and a voter output, each of the voter inputs connected to arespective output of one of the N threshold circuits; and an output nodeconnected to the voter output and providing an output logic signal,whereby errors arising in floor[(N−1)/2] or fewer of the thresholdcircuits are prevented from producing either an output logic signal thatis inconsistent with a majority of the threshold circuit outputs, orfrom producing an invalid output logic signal.
 2. The circuit of claim1, wherein the number N of threshold circuits is odd.
 3. The circuit ofclaim 1, wherein the threshold circuits comprise Schmitt triggers. 4.The circuit of claim 1, wherein the redundant threshold circuits areselected from the group consisting of a comparator, a comparator withhysteresis, and a clocked comparator.
 5. The circuit of claim 1, whereinthe input node is connected to an external pad of the integratedcircuit.
 6. The circuit of claim 1, wherein the output node is connectedto an external pad of the integrated circuit.
 7. The circuit of claim 1,wherein the threshold circuits have substantially matched output drivecapability, and the majority voter circuit comprises an analog majorityvoter in which the voter inputs are connected together at a summing nodethat is connected to the voter output.
 8. The circuit of claim 1,wherein the majority voter circuit comprises a digital majority voter.9. The circuit of claim 1, wherein the majority voter circuit comprisesM redundant digital majority voters each having N digital voter inputsand an individual digital voter output, and an analog majority voterhaving M analog voter inputs and an analog voter output, each of the Nthreshold circuit outputs connected to a respective digital voter inputon every digital majority voter, each of the M individual digital voteroutputs connected to a respective analog voter input, and the analogvoter output connected to the output node, whereby the analog majorityvoter prevents an output error from occurring due to errors arising infloor[(M−1)/2] or fewer of the digital majority voter circuits.
 10. Anintegrated circuit comprising: a semiconductor substrate having asurface; a functional circuit formed on the surface, wherein thefunctional circuit comprises at least one modular redundant thresholdcircuit comprising an input node, a number N of threshold circuits, eachhaving an input and an output, an input of each threshold circuitconnected to the input node, wherein the number N is equal to or greaterthan three, a majority voter circuit having voter inputs and a voteroutput, each of the voter inputs connected to a respective output of oneof the N threshold circuits, and an output node connected to the voteroutput and providing an output logic signal; and at least one pad usablefor connection to external circuitry, whereby errors arising infloor[(N−1)/2] or fewer of the threshold circuits are prevented fromproducing either an output logic signal that is inconsistent with amajority of the threshold circuit outputs, or from producing an invalidoutput logic signal.
 11. The integrated circuit of claim 10, wherein thenumber N of threshold circuits is odd.
 12. The integrated circuit ofclaim 10, wherein the input node is connected to a pad of the integratedcircuit.
 13. The integrated circuit of claim 10, wherein the output nodeis connected to a pad of the integrated circuit.
 14. The integratedcircuit of claim 10, further comprising a fault detection circuitconnected to the modular redundant threshold circuit and configured toprovide a diagnostic signal indicating an error occurring in the modularredundant threshold circuit.
 15. A method for generating an output logicsignal, comprising the steps of: providing an input signal to beconverted into an output logic signal; providing a number N equal tothree or more redundant threshold circuits, each having an input andproducing an individual output signal in response to a signal at itsinput; applying the input signal substantially simultaneously to theinputs of each of the threshold circuits; and performing a majorityvoting operation on the individual output signals of the thresholdcircuits to generate the output logic signal, whereby the output logicsignal is correctly generated as long as a majority of the thresholdcircuits produce correct individual output signals.
 16. The method ofclaim 15, wherein the number N of threshold circuits is odd.
 17. Themethod of claim 15, wherein the majority voting operation comprises ananalog majority voting operation.
 18. The method of claim 15, whereinthe majority voting operation comprises a digital majority votingoperation.
 19. The method of claim 15, wherein the step of performing amajority voting operation comprises providing M digital majority voters,where M is a number equal to three or more, each digital majority voterhaving N digital majority inputs and a digital majority output, applyingthe N individual output signals from the threshold circuits torespective inputs on each of the M digital majority voters, andperforming an analog majority operation on the M digital majorityoutputs to generate the output logic signal.
 20. The method of claim 19,wherein the number M of digital majority voters is odd.